REF6598 Network Infrastructure Command and Control

Rachid O@mrrachid

•updated May 12, 2026•3•0•274

Detects network connections to known REF6598 staging and command-and-control infrastructure, including a hardcoded staging IP and PHANTOMPULSE panel domains. This provides a high-fidelity signal of active PHANTOMPULSE infections and potential data exfiltration attempts.